Let's put it this way. If I could install ossec and do my own iptables/nftables work on my TV, I find it highly unlikely that a 0 day would slip past my alert

Let's put it this way. If I could install ossec and do my own iptables/nftables work on my TV, I find it highly unlikely that a 0 day would slip past my alert filter (most likely it would still work... but unless they are specifically wiping logs, traces, etc...)